Privacy Policy

Who runs this and what it is

006 Pixel is a noticeboard for a single campus. People post things they want to sell or give away and message each other about them. The site does not process payments, hold funds, ship anything, or act as a party to any transaction.

What is collected

• Email address — required to sign in. Never shown to other members.
• Display name — chosen by you or generated at random. This is the only identifier other members see.
• Google account identifier — only if you sign in with Google. The site requests your email address and nothing else: no profile, no photo, no contacts.
• Content you post — listing text, photos, prices, messages you send, meeting-point links, and ratings you leave.
• IP address — recorded when a sign-in code is requested, used to limit abuse.
• Browser user-agent — stored with your session so you can tell sessions apart.
• Activity needed to run the board — view counts, timestamps, deal confirmations, and moderator actions.

Photos are re-encoded on upload, which removes embedded metadata including any GPS coordinates your camera attached.

What it is used for

• Signing you in and keeping you signed in.
• Showing your listings and delivering your messages.
• Emailing you about your own deals. Chat messages do not generate email.
• Investigating reports, enforcing the rules, and detecting fraud.

There is no advertising on this site, no analytics product, no cross-site tracking, and no profiling.

Who else sees it

Personal information is not sold and not shared for advertising, and never has been. These are the only third parties that touch it, each strictly to make the site work:

• Google LLC — only if you choose to sign in with Google, to confirm your email address.
• Resend — delivers sign-in codes and deal notifications. Receives your email address and the message.
• Google Cloud Platform — hosts the server the site and its database run on.

Information may also be disclosed if required by valid legal process, or where necessary to investigate fraud or a threat to someone's safety.

Other members

Other members see your display name, your listings, your ratings and deal counts, and whatever you choose to write to them. They never see your email address. Moderators can additionally see email addresses, reported conversations, and proof-of-ownership photos.

How long it is kept

• Sign-in codes are deleted within a day of being issued.
• Sessions expire after 60 days and are then deleted.
• Conversations on boards marked anonymous are hard-deleted 30 days after the conversation starts.
• Resolved reports are deleted after 180 days.
• Listings, messages and ratings are kept while your account exists, because they are what other members' reputation records are built on.

Your choices and rights

California residents have rights under the CCPA/CPRA to know what is collected, to correct it, to delete it, and to obtain a copy. Those rights are offered to everyone here regardless of where you live:

• See and correct — your account page shows everything tied to you, and your display name can be changed there.
• Delete — request it from your account page. Requests are reviewed by a moderator rather than being instant, because self-service deletion would let someone take payment and then erase the complaints against them. Requests are answered within 45 days.
• Copy — ask through the report form and a copy of your data will be provided.
• No sale or sharing — there is nothing to opt out of, because personal information is never sold or shared for advertising.

A deletion request may be declined, in whole or in part, where the information is needed to detect or resolve fraud — a ground the CCPA expressly allows. If that happens you will be told why.

If you are under 18 and have posted something here, you can have it removed on request under California Business and Professions Code §22581.

Do Not Track

This site does not track its visitors across other websites, so a "Do Not Track" signal changes nothing about how it behaves. It is disclosed here because California law requires the disclosure either way.

Cookies

One cookie is used, holding a random session token so that you stay signed in. It is not readable by scripts, is not shared with anyone, and carries no advertising identifier. Two short-lived cookies are also set during a Google sign-in to protect that exchange, and are removed as soon as it finishes.

Security

Traffic is encrypted in transit. Sign-in codes and session tokens are stored hashed, never in plain form. Access to the server is limited to the operator. No system is perfect, and this one is run by a student on a single machine — please do not put anything here you could not bear to see leak.

Changes and contact

If this policy changes in a way that affects what happens to your data, a notice will be shown on the site before the change takes effect, and the date at the top will be updated. Questions and requests go through the report form.